pup.exe and pop-ups

[- T00LF00L -]

lately i've been getting popups even though i have NAV 2004 running
ad-blocker. then i noticed an app called 'pup' running in task manager. a
search produced an activeX component named pup.setup in the
windows\downloaded files, but pup.exe could not be located. suspecting
adware, i ran NAV, spybot, & ad-aware, all showing NOTHING! so, i looked in
registry under local machine/software/microsoft/windows/current version/run
once and first entry was '6672304.exe' located in windows/system32 folder.
BINGO! properties showed author as 'x' and original name as 'pup.exe'. ok,
so i deleted the file, deleted the registry key and all seems to be
fine.......

question: was this spyware/adware/virus, how did i get it, and why wasn't
it detected??

i can't seem to find any info on it, anyone else have a clue?! thanks again
folks!

[Delwin Lee [MSFT]]

It certainly doesn't come with Windows. f-prot antivirus software does come
with an executable named pup.exe, but I'm not sure if that's the same as the
one you've got.

--
Please reply in newsgroup.

This posting is provided "AS IS" with no warranties, and confers no rights.



"- T00LF00L -" > wrote in message
news:0ILwb.229002$275.864099@attbi_s53...
> lately i've been getting popups even though i have NAV 2004 running
> ad-blocker. then i noticed an app called 'pup' running in task manager.
a
> search produced an activeX component named pup.setup in the
> windows\downloaded files, but pup.exe could not be located. suspecting
> adware, i ran NAV, spybot, & ad-aware, all showing NOTHING! so, i looked
in
> registry under local machine/software/microsoft/windows/current
version/run
> once and first entry was '6672304.exe' located in windows/system32 folder.
> BINGO! properties showed author as 'x' and original name as 'pup.exe'.
ok,
> so i deleted the file, deleted the registry key and all seems to be
> fine.......
>
> question: was this spyware/adware/virus, how did i get it, and why wasn't
> it detected??
>
> i can't seem to find any info on it, anyone else have a clue?! thanks
again
> folks!
>
>

[Don Z.]

I had the same problem with pup and found your message while searching
for a solution. I also had multiple {numbers}.exe files in my
windows/system32 folder with a company of "x". Deleting all those
files and the keys in the registry seems to have killed it.

I am also surprized that there is so little info available on this
problem. Pup seems to slip by all the security programs you mentioned
and would seem to warrant some attention.

If anyone else does know anything about this please reply.



"- T00LF00L -" > wrote in message news:<0ILwb.229002$275.864099@attbi_s53>...
> lately i've been getting popups even though i have NAV 2004 running
> ad-blocker. then i noticed an app called 'pup' running in task manager. a
> search produced an activeX component named pup.setup in the
> windows\downloaded files, but pup.exe could not be located. suspecting
> adware, i ran NAV, spybot, & ad-aware, all showing NOTHING! so, i looked in
> registry under local machine/software/microsoft/windows/current version/run
> once and first entry was '6672304.exe' located in windows/system32 folder.
> BINGO! properties showed author as 'x' and original name as 'pup.exe'. ok,
> so i deleted the file, deleted the registry key and all seems to be
> fine.......
>
> question: was this spyware/adware/virus, how did i get it, and why wasn't
> it detected??
>
> i can't seem to find any info on it, anyone else have a clue?! thanks again
> folks!

[Timmy]

Had the exact same issue here. I did find this on Symantec's site...
http://www.symantec.com/avcenter/venc/data/adware.winpup.html
But your solution was easier.
Very surprised that adaware didn't find it.

Tim



>...
> I had the same problem with pup and found your message while searching
> for a solution. I also had multiple {numbers}.exe files in my
> windows/system32 folder with a company of "x". Deleting all those
> files and the keys in the registry seems to have killed it.
>
> I am also surprized that there is so little info available on this
> problem. Pup seems to slip by all the security programs you mentioned
> and would seem to warrant some attention.
>
> If anyone else does know anything about this please reply.
>
>
>
> "- T00LF00L -" > wrote in message news:<0ILwb.229002$275.864099@attbi_s53>...
> > lately i've been getting popups even though i have NAV 2004 running
> > ad-blocker. then i noticed an app called 'pup' running in task manager. a
> > search produced an activeX component named pup.setup in the
> > windows\downloaded files, but pup.exe could not be located. suspecting
> > adware, i ran NAV, spybot, & ad-aware, all showing NOTHING! so, i looked in
> > registry under local machine/software/microsoft/windows/current version/run
> > once and first entry was '6672304.exe' located in windows/system32 folder.
> > BINGO! properties showed author as 'x' and original name as 'pup.exe'. ok,
> > so i deleted the file, deleted the registry key and all seems to be
> > fine.......
> >
> > question: was this spyware/adware/virus, how did i get it, and why wasn't
> > it detected??
> >
> > i can't seem to find any info on it, anyone else have a clue?! thanks again
> > folks!